Table of Contents
Key Takeaway
- 🇦🇺 The warning is official: Australia’s cyber agency — the Australian Signals Directorate (ASD) — published its Annual Cyber Threat Report and told citizens to expect online services to go down unexpectedly — calling outages from defensive patching part of the new normal.
- 📈 The numbers behind it: ASD responded to more than 1,500 cyber security incidents in 2025-26, up over 20 percent, and notified entities of malicious activity more than 4,400 times — an almost 80 percent jump year on year.
- ⏱️ One report every six minutes: the Australian Cyber Security Centre logged 82,000 reports across the financial year.
- 🤖 AI redefined the threat: Director-General Abigail Bradshaw says frontier AI models have redefined the danger — both sides of the fight are AI-powered now, and disruption is “inevitable” with every capability increase.
- 🛠️ The doctrine shift: “system security must be prioritised over system availability” — meaning planned downtime, patch outages and isolation drills are officially better than always-on-but-breached.
Online services will go down unexpectedly, Australia’s top cyber agency says — and that is now the good news. The Australian Signals Directorate published its Annual Cyber Threat Report 2025-26 on October 26 and, inside it, issued the bluntest operational warning yet: more basic and important online services will go offline as vulnerabilities are found and patched, which is exactly what security-first operations look like when artificial intelligence is turbocharging both attackers and defenders. For businesses and governments worldwide — not just in Australia — the report reads as the arrival of a doctrine that treats availability as negotiable but integrity as not.
What the ASD Report Actually Said About Online Services Going Down
The numbers, from the report itself: ASD’s Australian Cyber Security Centre responded to more than 1,500 cyber security incidents in 2025-26 — an increase of more than 20 percent — and notified entities of potential malicious activity more than 4,400 times, an almost 80 percent increase on the previous year. The centre took 82,000 reports across the financial year: one every six minutes. Nearly half of the 1,500 incidents were in the public sector. Over five years, reported incidents have climbed 36 percent.
The headline warning came from ASD Director-General Abigail Bradshaw: “What is inevitable is that with each capability increase, we are likely to see more disruption.” Disruption, she explained, “can look like what we’ve seen over the last few weeks, with websites that require patching having to be taken down in order to be secured… Disruption could look like data breaches. Disruption could look like service disruption.” Days earlier, Australian government websites — including the ASD’s own — had been partially taken offline after vulnerabilities were found. Two weeks before that, hackers exploited flaws in online systems to raise the temperature in supermarket fridges in France.
The doctrine sentence everyone will repeat: “System security must be prioritised over system availability in order to deal with increased vulnerability discovery by new AI models… the prospect of compromise has increased.” That means the agencies of a Five Eyes nation are publicly saying: expect the takedown-for-patching pattern; learn to distinguish it from breach.
Why Online Services Are Being Taken Down on Purpose
The paradox at the heart of the warning is that these outages are often the system working. AI frontier models — the same class of technology behind this week’s scientific breakthroughs — are also superb vulnerability-finders: they code, test and probe at machine speed, surfacing flaws faster than organizations can patch them. When a critical flaw is discovered in a live edge system, the responsible response is frequently to pull the service offline rather than serve it insecure. The ASD’s warning simply makes that behavior a public expectation: outages will happen on purpose, and citizens should learn to tell a patch window from a breach.
The report also confirms what defenders have argued all year: malicious actors — hostile governments, criminal networks and hacker-for-hire operations — are using AI to gather intelligence, disrupt critical infrastructure and steal money at greater speed, scale and precision. Bradshaw’s line on this is the report’s thesis: AI is “enabling malicious cyber actors to identify vulnerabilities and to conduct attacks faster, at greater scale, and with greater precision than before. This shift will only accelerate.”
How to Prepare for Online Services Going Down: the ASD-Aligned Checklist
Cyber.gov.au’s key actions list gives every person and business the floor for securing online services. The preparedness layer above it — the parts the report directs at organizations — is where continuity gets real:
- Basic hygiene first: review privacy settings, enable multi-factor authentication or passkeys, update devices on schedule — the basics remain the majority of the defense, and the report repeats them as everyone’s responsibility.
- Plan for the patch outage. Services you depend on — banking, government portals, communications — will have windows where they disappear to be secured. Keep offline copies of what matters: account statements, prescriptions, key documents, the numbers you would need if your main apps vanished for a day.
- Isolate what must survive. The report’s hardest-hitting guidance, under its CI Fortify program, tells critical-infrastructure operators to be ready to physically isolate vital systems from the internet for up to three months while continuing to deliver essential services — and to be able to fully rebuild those systems afterward. Translated for smaller businesses: know which systems are load-bearing, keep them separable, and rehearse running without them.
- Watch for the tell-tales of the new normal: a service vanishing with an official security notice is a patch; a service degrading with no notice is a possible incident — report suspicious activity to your national cyber authority or hotline.
Print the doctrine sentence and tape it where you plan your week: when a service you depend on disappears with a security notice attached, that is the system protecting you, and the ASD report says to expect it as routine. For households and small teams, our practical guides cover the floor the ASD assumes: the first-hour email recovery playbook for when personal accounts are the entry point, our guide to securing edge devices before attackers turn them against you, and the 10-point fake-website check for the phishing waves that follow every outage headline — because scammers pose as the recovery service within hours.
What the ASD Warning Means Beyond Australia
Australia is not describing a uniquely Australian problem — the disruption doctrine applies to online services everywhere. The report’s logic is global by construction: AI accelerates vulnerability discovery everywhere; every government, business and utility on earth runs online services with the same exposure; and the choice between availability and security is the same choice everywhere. When as Five Eyes agency codifies “security over availability” in an annual report, procurement manuals, board agendas and national resilience plans in other capitals start updating on the same logic — the language is already visible in how other agencies talk about critical infrastructure.
For Filipino readers, the translation is direct. Philippine banks, government portals and the apps OFWs depend on run the same architecture the ASD is describing — and the same AI-era patch cycles are coming to them. The households and businesses that keep offline copies, rehearse continuity and separate essential systems will experience the coming wave as an inconvenience; those that treat every login as the system itself will experience it as an emergency. The preparedness gap, not the threat level, is what will differ between them.
There is also a workforce angle worth naming: resilience engineering, patch-window operations and OT isolation planning are becoming named disciplines — the report’s CI Fortify series is effectively a job description for a sector that barely existed five years ago.
The OFW and Family Angle: Preparedness for the People Who Cannot Afford Downtime
A Filipino household’s dependence on online services is not casual — remittances, government portals, school systems and the apps that connect overseas workers to home all sit on the same networks ASD describes. When those services enter patch windows or suffer AI-era incidents, the stakes are family logistics, not convenience. Three moves make the difference, and each maps to something the report and our own guides already teach.
First: keep an offline family continuity sheet — account numbers, embassy and hotline contacts, insurance and health records, the details of a remittance corridor you can use if the main app is down. The report’s “one every six minutes” cadence means somebody in nearly every extended Filipino network will hit a service outage this year; the prepared ones lose an hour, not a week. Second: secure the entry points now with the recovery playbooks we published this week — the WhatsApp recovery playbook and the verification-code scam it explains, alongside the email recovery guide already linked above — because account takeover is how most “service disruption” feels at the personal level. Third: treat remittance schedules with outage-awareness: schedule transfers with buffer days around known maintenance windows, and remember that a delayed transfer you planned for is frustration, while an unplanned one can cascade into missed tuition dates and penalty fees.
For businesses in the Filipino enterprise family — BPO teams, small exporters, online sellers who serve OFW customers — the isolation lesson of the ASD report scales down cleanly: identify which of your systems are load-bearing, keep paper or offline fallbacks for the transactions that cannot wait, and rehearse the patch-window conversation with customers before a takedown forces it. The agencies have stated the doctrine; the households and businesses that internalize it early will meet AI-era disruption as an inconvenience others absorb as catastrophe.
FAQ
Why is Australia warning that online services will go down?
The ASD’s 2025-26 Annual Cyber Threat Report states that as AI expands both attack capability and vulnerability discovery, critical services will increasingly need to be taken offline to be patched and secured. The agency wants the public to treat these defensive outages as expected — and distinguish them from breaches.
How many incidents did Australia’s cyber agency handle?
ASD responded to more than 1,500 cyber security incidents in 2025-26 (up over 20 percent) and notified entities of potential malicious activity more than 4,400 times, an almost 80 percent year-on-year increase. The ACSC received 82,000 reports — about one every six minutes.
What did the ASD say about AI?
Director-General Abigail Bradshaw said AI frontier models have “redefined” the threat: hostile governments and criminals are using AI to find vulnerabilities and attack “faster, at greater scale, and with greater precision,” and the agency argues defenders should “fight fire with fire” by adopting AI to build resilience.
What should small businesses do first?
The ASD’s floor still applies everywhere: MFA or passkeys enabled, privacy settings reviewed, systems patched on schedule, staff educated. Then the continuity layer: offline copies of critical records, a written plan for what happens if your main service disappears for a day, and an isolation plan for the systems your business cannot operate without.
Does “system security over system availability” mean constant downtime?
No — it means downtime is now an accepted defense rather than a failure. The report says nothing about living offline permanently; it says the integrity of the system outranks the convenience of the moment, and planned takedowns to patch are preferable to staying online while compromised.
The Global Resilience Wave Has Already Started
The doctrine sentence is also an export. Resilience frameworks such as the ASD’s CI Fortify isolation standard are the kind of artifact other national cyber centers re-publish, adapt and teach; annual threat reports get translated, briefing-by-briefing, into other agencies’ guidance. Where Australia goes with “security over availability,” allied agencies follow within quarters — the same pattern every previous crisis-driven doctrine took, from zero-trust to backup mandates. The practical effect for businesses in every market: patch-window planning, offline recovery media and isolatable architecture move from best practice to procurement requirement over the coming year.
The Bottom Line
One every-six-minutes report cadence, a 20 percent incident jump, a near-80 percent notification surge, and a doctrine sentence that would have sounded radical five years ago: “system security must be prioritised over system availability.” Australia is not predicting an apocalypse — it is describing the operating rhythm of the AI era, in which defenses get patched by taking services down and resilience is the difference between a bad hour and a bad month. The preparedness checklist above is the report in actionable form; every nation’s cyber agency will say something similar soon, and the warning arrives already too real for the sectors it names.
Sources: the ASD Annual Cyber Threat Report 2025-26 (cyber.gov.au), The Guardian, ABC News, and AAP.
